Launch Week Day 1: Announcing Security Design Review
HIGH 7.5 Maven

Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation

GHSA-h24p-qwf4-84q8 · CVE-2017-7669

Published · Modified

Description

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.

Ready to move

Start Securing

Free, no credit card | First findings in minutes